Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Water Orthrus (threat actor)

Risk

High

1 techniques 40 tools/malware 35 vulnerabilities 39 IOCs 2/7 stages covered Deepest: Command & Control

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2017-18368

CVE CVE-2019-0803

CVE CVE-2022-24086

CVE CVE-2022-26706

CVE CVE-2022-40982

CVE CVE-2022-47378

CVE CVE-2022-47391

CVE CVE-2022-47393

CVE CVE-2022-47966

CVE CVE-2023-20569

CVE CVE-2023-20583

CVE CVE-2023-20593

CVE CVE-2023-20890

CVE CVE-2023-23397

CVE CVE-2023-26359

CVE CVE-2023-2868

CVE CVE-2023-32315

CVE CVE-2023-34039

CVE CVE-2023-3519

CVE CVE-2023-36844

CVE CVE-2023-36845

CVE CVE-2023-36846

CVE CVE-2023-36847

CVE CVE-2023-38035

CVE CVE-2023-38180

CVE CVE-2023-38831

CVE CVE-2023-40477

CVE CVE-2023-41183

CVE CVE-2023-42793

CVE CVE-2024-20399

CVE CVE-2024-7971

CVE CVE-2025-24201

CVE CVE-2025-53690

CVE CVE-2026-21509

›

5 Installation

No data

›

6 Command & Control

T1056.001

Keylogging collection

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors BlueNoroff Buhtrap Cobalt CopperPhish CopperStealer CopperStealth CraxsRAT Dark DarkHotel Explorer GitHub Global HiatusRAT Jackal Kimsuky Leverage LockBit Malware Matrix Naikon Nexus OilRig Payload Payload Phishing emails Poseidon QuiteRAT Rootkit Samurai SentinelOne Spear-phishing TeamSpy Telegram Trojan Tsunami Unknown Void Winrar phishing

Indicators of Compromise (39)

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +13 more

Filename

wuauclt.exe Explorer.exe 360sd.exe wmiprvse.exe preinstall.js weblinks.cmd 360safe.exe QQPCTray.exe +6 more

SHA-256 Hash

48211c6f957c2ad024441be3fc32aecd7c317dfc92523b0a675c0cfec86ffdd9 8a21eae144a23fffd35f8714964ff316caaa37fe464e8bbc143f4485119b5575

URL

http://www.msftconnecttest.com/connecttest.txt http://cnzz_url&m=

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

1 strategies

1/7 stages covered

Command & Control (1)

DET0089 Behavioral Detection of Keylogging Activ...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Water Orthrus

Type: Unknown Active

Cozy Bear Fancy Bear BlueBravo APT29 APT28 +35 more

Infrastructure 23 IOC(s)

50%

Domain

demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +16

URL

http://www.msftconnecttest.com/connecttest.txt http://cnzz_url&m=

Artifacts (16)

wuauclt.exe Explorer.exe 360sd.exe wmiprvse.exe preinstall.js weblinks.cmd +10

Capability

50%

1 technique(s) 40 tool(s)/malware 35 CVE(s)

Backdoors BlueNoroff Buhtrap Cobalt CopperPhish CopperStealer CopperStealth CraxsRAT +32

collection

T1056.001

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy education aerospace manufacturing healthcare media maritime information-technology think-tank critical-infrastructure nuclear retail chemical pharmaceutical transportation hospitality gaming mining legal-services entertainment

Targeted Countries

CN US TW JP DE IN GB KR RU UA SA AU IR PL FR TR PK VN IL CA ES KZ BY SG KP IT AE BR NL MX AZ RO IQ EG SY NG

Diamond Model Meta-Features

Phase

Command & Control

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1056.001

Capability (Malware)

Backdoors BlueNoroff Buhtrap

Infrastructure

demo-cloud.space TEMP.Hermit TEMP.Veles